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ABSTRACT 



A network hub responds to network problems by generating 
traps in conformance with the Simple Network Management 
Protocol (SNMP). In generating a trap, the hub includes a 
Uniform Resource Locator (URL) as a text string incorpo- 
rated in the trap. The network hub incorporates a server 
conforming to the HyperText Transfer Protocol (HTTP) 
used by the World Wide Web. The server has its own home 
page and the URL incorporated in the trap points to a 
subpage of that home page. When a network management 
station receives the trap, the URL is displayed as a hypertext 
link. When the link is "clicked", a web browser is activated 
and is pointed to the URL so that an HTTP "get" command 
is transmitted. When the hub receives the "get** oonunand, it 
responds by generating the requested subpage. The subpage 
is presented as a World Wide Web page with a full presen- 
tation of data relating to the event triggering the trap. In 
addition, the subpage includes active elements (hypertext 
Unks, buttons, and/or menu items) that when activated 
initiate a course of action to address the detection of the 
network problem. 

5 Claims, 5 Drawing Sheets 
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■^■■Network Loop; Detected :on porl'Xev^ " • i-f^ : ' 



Description: 

A n&tv^ork loop has been detected. 

Solution: 

« Locate and remove the network loop. 
Port DtsaSiled; 

Port XCVR was temporariiy disabled to keep netsvork opefetionai. Click on the button betowto enable 
the port and acknowtedge the e^*ent. 



if this is a cascaded port (\.b. ^ the device connected to this port is not an end-node), this problem may be 
cccuaing eisewhene en the LAN connected tu this puit. 




figure 5 
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NETWORK APPLIANCE COMBINING 
ASYCHRONOUS NOTIFICATION WITH 
INTERACTIVE NETWORK TRANSFER 
PROTOCOL SERVER 

BACKGROUND OF THE INVENTION 

The present invention relates to computer networks and, 
more particularly, to a network appliance that monitor 
parameters (e.g., related to their own and/or a netN^'ork's 
performance). A major objective of the present invention is 
to facilitate fault handling in a computer network. 

Computer networks allow computer users to 
communicate, collaborate, and share resources. While there 
are peer-to-peer computer networks, most sophisticated net- 
works use network infrastructure appliances, e.g., hubs, 
switches, and routers, to manage communication between 
end-node appliances, e.g., computers, printers, modems, 
instrumentation, etc. A typical network infrastructure appli- 
ance includes multiple ports, each of which can be coupled 
to an end-node appliance or another network appliance. 
Networked end-node appliances communicate with each 
other through the network infrastructure appliances. 

Just as individuals rely increasingly on computers for 
getting their work done, corporations rely increasingly on 
networks for getting their personnel to work cooperatively. 
When a network fails, group eflforts grind to a halt, as do 
individual efforts relying on network resources. To a lesser 
degree, productivity is adversely affected when network 
performance is impaired. Accordingly, maintaining a net- 
work working and performing at optimal levels is highly 
desirable, if not critical. Unfortunately, such maintenance 
can also be quite difiScult. 

Many network appliances monitor performance-related 
parameters and, when the values of these parameters fail to 
meet certain criteria, transmit a notification to that effect 
over the network. For example, network infrastructure appli- 
ances often include counters for counting certain network 
related events (e.g., packet collisions); when a count or 
combination of counts indicates a problem, a "trap" can be 
transmitted in accordance with a Simple Network Manage- 
ment Protocol (SNMP). For another example, a printer can 
monitor its components; when a problem is detected, the 
printer can transmit an "inform" in accordance with a 
Desktop Management Interface (DMI) protocol. 

The various notifications can be received by a network 
management station, such as a computer devoted at least in 
part to network management. The network management 
station can present the notifications to a human 
administrator, who can determine whether or not corrective 
action is required and who can undertake corrective action 
if required. 

In many cases, the information included in the notification 
is not comprehensive. Transmitting all pertinent information 
regarding triggering events might unduly burden a network; 
also, the pertinence of the information might wane if the 
administrator does not address the notification immediately. 
Accordingly, a concise notification is often a prelude to a 
more detailed investigation by the administrator. 

When the more detailed information is desired, the 
administrator can request (through the network management 
station) that the network appliance transmit additional infor- 
mation. If the detailed information is presented in "raw*' 
form, considerable demands are made on the expertise of the 
administrator in interpreting the data to diagnose the prob- 
lem and in evaluating alternative courses of action. These 
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demands are compounded in the common case where the 
network includes many appliance types, each with its own 
relevant parameters and ahemative corrective actions. Since 
the individual trigger events might occur infrequently, an 
5 administrator might have to refer to the appropriate appli- 
ance manual each time a triggering-event notification is 
received. 

The burden on the administrator can be relieved consid- 
erably by including the expertise into the network manage- 
10 ment station. The network management station can include 
a characterization of each appliance type on the network. 
The characterization can be used in interpreting appliance 
data and in suggesting alternative courses of action. 

While such a solution appears feasible in a network in 
which all appliances (including the network management 
station) are from a single vendor, it is less workable where 
there are appliances from multiple vendors involved. 
Furthermore, when a new appliance type is added to the 
network, the network management station would have to be 
updated (e.g., through a patch or module added to the 
network management program running on the network man- 
agement station). This might mean that each new apphance 
would have to be sold with program updates for each 
network administration program. 

Thus, however they are allocated between the adminis- 
trator and the network management station, the tasks of 
notification data interpretation and of determining responses 
can be unduly burdensome. What is needed is a network 
administration system, which minimizes the burden on the 
network administrator while allowing ready expandability 
of a network. 

SUMMARY OF THE INVENTION 

35 TTie present invention provides a network appliance that 
incorporates both asynchronous notification of "triggering" 
events and a server that conforms to an interactive network 
transfer protocol such as the HyperText Transfer Protocol 
(HTTP). When the network appliance detects a triggering 

40 event calling for notification to the network management 
station, it issues the notification and specifies therein a 
"Uniform Resource Locator" (URL) including a "Uniform 
Resource Identifier" (URI) pointing to a network location on 
the server, 

45 Complementarily, the present invention provides for a 
variety of ways for a network management station to handle 
the notification. For example, it can simply inform a user of 
the URL by displaying it in text form on a display. In this 
case, a user can copy the URL to a web browser (or other 

50 HTTP-enabled program), and access the location character- 
izing the triggering event. Preferably, the network manage- 
ment station either incorporates or interfaces with a browser 
so that a simple point and click operation accesses the 
network appliance server. In this vein, the network manage- 

55 ment program can present the URL as a hypertext link, as a 
button, or as a menu selection. Activating the link, button or 
menu item can access the URL directly or, alternatively, call 
a browser that in turn accesses the URL. 
When the URL is accessed, the network appliance server 

60 can provide the information relating to the event in con- 
formance with the HTTP standard. Preferably, the informa- 
tion is presented on a web page that is a subpage of a home 
page associated with the server. Also preferably, the subpage 
can include active display elements (hypertext links, 

65 buttons, and/or menu items) that can initiate network man- 
agement actions appropriate to the triggering event. These 
actions can involve changing the slate of the network 
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appliance (e.g., by resetting counters) for further diagnosis tion are apparent from the description below with reference 

or for ignoring the event. To conserve memory on the to the following drawings, 

appliance, the subpage can be generated after the URL is OFSPRTPTFON OF THF ORAWTNnS 

received (rather than when the notification is transmitted). ^^^^^ DESCRIPTION OF THE DRAWINGS 

Unlike most appliances with web servers, the present 5 FIG. 1 is a schematic diagram of a networic incorporating 

invention provides for efficient access to asynchronous (not present mvention. 

initiated by the user) events at the server. For the most part, FIG. 2 is a schematic diagram of a hub of the network of 

the web interface is operated by user commands; in other FIG. 1 and incorporating the present invention, 

words, the web interface mostly provides for synchronous FIG. 3 is a data flow diagram of a method of the present 

communication from the server and the user. Combining the invention practiced in the context of the network of FIG. 1. 

web. interface with a network or appliance management FIG. 4 is an image of a portion of a window on a network 

protocol allows asynchronous network events to initiate management station generated in response to notifications 

interaction with the web server on the network appliance. In transmitted in accordance with the method of FIG. 3. 

general, access to appHances is through the home page. It is 5 ^3 ^„ • ^ browser window on a network 
often necessary to navigate to vanous subpages to find 15 j^^nagement station generated in response to a "get^' request 

information of mterest. By providing the URI (the part of the ^^^^ accordance with the method of FIG. 3. 
URL mdicating the location withm a server where certain 

information can be found), the present invention avoids the DETAILED DESCRIPTION OF THE 

tedium of navigating through a web interface. PREFERRED EMBODIMENTS 

An interactive-network-transfer protocol is a network In accordance with the present invention, a network 
protocol in which: 1) a client can transinit a command to a system API includes three repeater hubs HI, H2, and H3, 
server; 2) the server responds to the command by transmit- three computer workstations Wl, W2, and W3, a mono- 
ting (generating first if required) data including active ele- chrome laser printer PI, a color laser printer P2, and a color 
ments to the client; 3) the client displays the data including ink-jet printer P3, and eight cables. Six of the eight cables 
representations of the active elements; 4) activation of active are coupled to the six node appliances Wl, W2, W3, PI, P2, 
elements by a client user causes data to be transmitted to the P3; the other two cables CHI and CH3 couple hubs, 
server; and 5) the server, upon receiving data transmitted in Hub HI has four ports, Pll, P12, P13, and P14. Port Pll 
response to activation of an active element, performs some is not being used. Port P12 is coupled to printer PI. Port P13 
action, typically involving the transmission of data to the is coupled to hub H2 via cable CHI. Port P14 is coupled to 
cHent so that the client display is modified. HTTP is the most workstation Wl. Workstation Wl includes a hard disk HDl 
widely familiar interactive-network-transfer protocol. on which a network management program and a web 
However, the invention can be applied in the context of browser are stored. 

alternative interactive-network-transfer protocols. Hub H2 also has four ports, P21, P22, P23, and P24. Port 

One advantage of the present invention is that it provides P21 is coupled to port P13 of Hub HI via cable CHI. Port 

a familiar interface for a network administrator to manage a P22 is coupled to printer P2, Port P23 is coupled to hub H3 

network. For example, the World Wide Web is not only a via cable CH3. Port P24 is coupled to workstation W2. 

standard interface for the Internet, but also for intranets. Hub HI has four ports, P31, P32, P33, and P34. Port P31 

Also, there is a trend to provide network appHances with is coupled to port P23 via cable CH3. Port P32 is coupled to 

web interfaces. Thus, minimal training is required for a printer P3. Port P33 is not being used. Port P34 is coupled 

network administrator to learn the interface. to workstation W3. 

A second advantage of the invention, which is both subtle Hub HI comprises a repeater 12, a processor 14, volatile 
and surprising, is that it obviates the need to update the random-access memory (RAM) 16, nonvolatile flash 
network management software as new types of network memory 18, and a media access controller 20, as shown in 
appliances are incorporated into the network. All the infor- 45 FIG. 2. The latter four elements are coupled via a commu- 
mation regarding a triggering event and the options for nications bus 22. Repeater 12 includes groups of counters 
handling it are handled by the web server on the network PCI, PC2, PC3, and PC4, which are dedicated to respective 
appliance. The network management program on the net- ports, and a repeater-wide group of counters PCR. Processor 
work management station does not need to have a charac- 14 executes programs stored in flash memory 18, controUing 
terization of each network appliance. The only requirement 50 repeater 12 directly over a control bus 24. These appliance- 
is that the network management program be able to com- resident programs provide for network monitoring processes 
municate the URL associated with the triggering event to the by reading the counters, event handling, web serving, and 
user or to the user's browser. storing event data in volatile RAM memory 16 in the form 

A third advantage is that effort on the user's part in of a Management Information Base (MIB). Media access 
accessing information about the triggering event is mini- 55 controller 20 is coupled to repeater 12 through an internal 

mized. In a typical realization of the invention, one point- port PCH, permitting controller 20 to serve as the source and 

and-click operation is required to access the relevant page of destination of network communications, 

the appUance server; one more point-and-click is often The functional components of hub HI are represented in 

suflBcient as a response to the triggering event. FIG. 3. Multiple networic monitoring processes 301 are 

A fourth advantage is that network burden is minimized. 60 performed in parallel by polling various hub counters. When 

Since the network appliance provides the notification a count or a calculation based on counts goes beyond a 

asychronously, there is no need for a network management trigger threshold, an event handler 302 activates an event 

station to maintain a continuous connection with or to trigger at 303. The event trigger causes the data pertinent to 

repeatedly poll appliances employing the present invention. the triggering event to be stored in Management Information 
Thus, network traffic directed to network management is 65 Base at 304. 

minimized when there are no problems requiring notifica- The event trigger identifies an enterprise based on the 

tion. These and other features and advantages of the inven- triggering event to a trap builder 305 of event handler 302. 
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Management Information Base 304 provides the values A major advantage of the illustrated hub operation is best 

(binds) for the parameters (variables) associated with the understood from the perspective of the user Once notified 

enterprise. Included among the parameters are those asso- asynchronoiisly of a problematic event, the user needs only 

ciated with the triggering event and a Uniform Resource to "point and click*', e.g., with a mouse, once to obtain a 
Locator (URL) in the form of a text string. 5 complete description of the problem. Furthermore, the 

The URL includes two portions: a first that identifies the description is provided using a standard ergonomic graphi- 

web server network address; and a second, the Uniform cal interface. One more point and click by the user can 

Resource Indicator (URI), that indicates web content on the instigate a corrective action. Thus, many network problems 

server. To save on memory, no web page is acnially created can be addressed with a pair of point and click operations, 

at the web location pointed to by the URI when the trap is Another major advantage of the invention comes into 

generated. Instead, the web page is created after it is operation when the network is upgraded by adding a new 

requested in response to an HTTP "get" request. type of network appUance incorporating the present inven- 

Trap builder 305 transmits the trap over the network to ^io"- The network appliance can include provisions for 

network management station Wl, whence it is passed to monitoring new parameters and new options for responding 

network management program 401, and more specifically to to network problems can be provided. The present invention 

its trap handler 402. Trap handler 402 notifies the user 404 allows such a network apphance to be added to the network 

by placing a message on the computer display at 403 that a without replacing or updating the network management 

network event has taken place. In addition, trap handler 402 station. 

provides the trap data to other portions of management In the preferred embodiment, the network appUance is a 

program 401 for logging and other standard network man- hub; the invention applies to other network infrastructure 

agement actions to be taken. appfiances such as switches and routers, as well as to 

User 404, once notified, can use a pointing device such as end-node appliances such as computers, printers, and 

a mouse to cUck on a button displayed at 403 that calls web modems. While, in the preferred embodiment, the network 

browser 405. This action is shown at jointed arrow 406. As apphance conforms to SNMP, other protocols, .such as DMI 

web browser 405 is accessed, trap handler 402 passes at 407 and proprietary protocols, can be employed, 

the URL generated by trap builder 305 to web browser 405 In the preferred embodiment, the apphance transmits the 

so that it is incorporated into an HTTP "get" action at 408. URL in its entirety as a text string. In this case, it is the 

The "get" action is transmitted to a web server 306 of hub content, not the form of the URL that is important. For 
HI. The web server parses the Uniform Resource Indicator 3^ example, the URI can be transmitted and the server portion 

and provides it to an incorporated content creator 307. of the URL can be constructed from the notification in 

Content creator 307 accesses Management Information Base accordance with the protocol employed. 

304 to determine the nature of the triggering event. Content The network management station can present the URL as 

creator 307 also accesses a web design module 308 to a hypertext Hnk. Alternatively, the URL can be presented as 
determine how information about the event and other 3^ text that can be copied and pasted into a browser Instead of 

appliance-specific information is to be presented. Apphance- a hypertext link, the URL can be presented implicitly as a 

specific information is useful since the same event, e.g., a button or as a menu option. When an active element corre- 

colhsion count, can have different implications for different sponding to the URL is activated, the appliance can be 

appliances (e.g., hubs versus switches). The web design accessed directly by the network management program (if it 
information and the event information are coordinated by ^ incorporates the HTTP protocol) or indirectly (in which 

content creator 307, which thus generates a web page case, the network management program calls the browser 

(having the URL generated by trap builder 305 as its and preferably passes the URL to it), 

network address). This web page is transmitted as an HTTP while HTTP is the dominant interaclive-network-transfer 

response at 309 to web browser 405, whence it is displayed protocol, the present invention provides for alternatives that 

45 provide for active elements. The parameters can be of 

The web page identifies the event that triggered the trap, several types: those that indicate problems with the network; 

organizes the data related to the event, and fists alternative those that indicate problems with the appliances incorporat- 

courscs of action that can be taken. Actions that can be ing the invention; and problems associated with appliances 

performed without additional intervention are presented as monitored by an apphance in accordance with the invention, 
buttons in the browser. When activated at arrow 410, a 50 For example, a redundant uninterruptable power supply 

button causes an HTTP message to be communicated to web might be coupled to a network appliance through a non- 

server 306, which then implements the action called for network connection (e.g., a serial port) to indicate when one 

(e.g., reading MIB 304, or by resetting a network monitor of the redundant component fails; in this case, the network 

process). appUance can "translate" the power supply notification to 

FIG. 4 shows a portion of a window in network manage- 55 one receivable by the network management station, 

ment program showing two sequential notifications, first a Accordingly, the present invenfion provides for maintenance 

warning, then a stop, of a network loop on an appUance with of both network and non-network appliances from a com- 

a URL http:\\10.7.11.15. CUcking on either Une activates a mon network management program, 

drop down menu. Selecting "browse URL" sends a "get" In the preferred embodiment, the server is contained 
request to the appUance server. Performing this sequence for 60 entirely within the appliance enclosure. However, the inven- 

the lop Une causes the web page shown in FIG. 5 to be tion provides for the use of a server that is partly or 

generated, transmitted, and displayed. In this case, the web completely external to the appUance enclosure. For example, 

page describes the problem detected, offers a solution, and the appUance can send a URL pointing to an external server, 

indicates what ports, if any, have been disabled automati- This server can either access the appUance or maintain a 
cally. In addition, four active elements, in this case buttons 65 copy of the appUance 's Management Information Base, 

with text, offer one-cUck access to alternative courses of Such a server can serve several appUances in accordance 

action. with this variation of the invention. In another alternative 
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embodiineat, the appliance provides the URL associated 
with its ioteraal server, but forwards the "get" command to 
a remote server. Both these alternatives minimize the storage 
requirements for individual appliances. 

The invention applies to appliances that monitor a single ^ 
parameter as well as to appliances that monitor multiple 
parameters. In the latter case, the invention applies to 
appliances that look at a combination of parameters to 
determine when some notifications are to be made. In the 
latter case, plural scalar or vector parameters can be treated ^0 
as a single vector parameter, the values for which are also 
vectors. These and other variations upon and modifications 
to the present invention are provided for by the present 
invention, the scope of which is limited only by the follow- 
ing claims. ^5 

What is claimed is: 

1. A network appliance comprising: 

a set of ports for coupling to network devices other than 
said appliance; 

20 

counters for detecting and enumerating instances of 
respective event types relating to the performance of 
said network, at least some of said counters being 
coupled to respective ones of said ports for examining 
data received thereat; 

execution means for executing a program, said execution 

means being coupled to said counters; 
computer readable media coupled to said execution 

means; 
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a monitoring program embodied in said computer read- 
able media, said monitoring program when executed 
retrieving counts from said counters, 

calculating values of network -performance related param- 
eters as a function of said counts, 

comparing said values with thresholds to determine 
whether or not a notification should be generated, and 

in the event a comparison indicates that a notification 
should be generated, generating and traosmitting on 
said network a notification that specifies a network 
location associated with said network monitoring pro- 
gram; and 

a server application for, in the event that said network 
location is addressed, specifying a course of action to 
be taken to mitigate a problem associated with said 
notification. 

2. A network appliance as recited in claim 1 wherein said 
network address has the format of an Uniform Resource 
Locator. 

3. A network appliance as recited in claim 2 wherein said 
network address has the format of a World Wide Web 
address. 

4. A network appliance as recited in claim 3 wherein said 
server application has a home page, said network address 
pointing a subpage of said home page. 

5. A network appliance as recited in claim 4 wherein said 
server application generates said subpage upon reception of 
said network address from another network device. 
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